For maximum security (no cloud sync): KeePassXC
In both cases an essential feature applies: if you forget your master password you've lost access to your password database.
Bitwarden (optionally with self-hosted Vaultwarden) - Best UX for the FOSS options, syncs all your devices, overall just pretty good.
Website: https://bitwarden.com/
Vaultwarden: https://github.com/dani-garcia/vaultwarden
Desktop: https://keepassxc.org/
Android: https://www.keepassdx.com/
iOS: https://strongboxsafe.com/
Syncthing: https://syncthing.net/
pass: https://www.passwordstore.org/
gopass: https://www.gopass.pw/
However, I have just started exploring using vaultwarden (a rust rewrite of bitwarden, which is self-hosted).
It's doable, but you have to import the public gpg key of everybody who needs to access the secrets. Effectively, every secret ends up encrypted with the public key of every user who needs access - not sure how scalable it would be if you have more than a small team of people accessing it this way.
It has first-class support for multiple stores and it's 100% compatible with pass databases.
Since it interfaces with GPG I would suspect something to do with how your gpg configuration is set up (is it trying to talk to a gpg-agent or possibly a pin-entry program that is timing out or something like that). Intrinsically what it does is completely trivial in terms of compute etc.
I sync via WebDAV on my Synology NAS and I’m not really worried to lose anything since every synced device has a full copy of the data.
Thought about switching to 1password a few months back since we’re using it at work and the client is better but they don’t have an Enpass import. It supports some kind of CSV transfer but I don’t want to pay for a bunch of, worst case scenario, not really perfectly structured data so I decided to stick with what I have.
Edit: when thinking of switching I was a little nitpicky. I’m pretty happy with Enpass everything considered. 1p client is just even better but with the give them your data and your money thing, which I’m not necessarily fond of
"no-nonsense, ad-free, tracker-free, and cloud-free manner. Free and open source."
Pair with Syncthing to go across devices.
It's worth noting that they really fubared the 1Password 8 transition and I was very irritated that they had me looking at alternatives. However, they gradually fixed the problems and missing features and now I'm 100% satisfied with it again.
I’d never use 1Password again. While the software may be good when you try it, I’m sure they will ruin it at a later date. That was my experience. The company earned my enmity.
The downside is that is cloud based.
It's only a matter of time before 1Password has a real security problem because the business forces at 1Password appear to be much stronger than the engineering forces.
I've used 1password for 16 years and it is SOLID.
This is very much a case of "don't invent your own cryptosystem", especially not in bash.
The metadata leakage is not good from a privacy standpoint, but brings about much more important security benefits that are mentioned in the post. Using Gopass will hide metadata.
Even “opensource” apps such as strongbox and keepassium have no way of asserting that whatever code they publish on GitHub is the same that I’m installing through the AppStore.
Am I just overly paranoid?
This is the main hindrance for me to using KeePassXC everywhere. If I’m going to blindly trust anyone I prefer to trust apple keychain.
Like all services I self-host for personal use, it's only accessible via VPN.
If you want to save some money, it will give you an automatic 25% discount if you just wait around for some amount of days before buying the full version. Applies to both versions of the app.
Kepass kdb file compatible but can access through browser interface. Backup kdb file to cloud storage.
Don't like bitwarden. Keeping your encrypted password file in Google drive is much better and portable than self hosting on your own server.
There is also Passage, which is a similar offering, but I have problems with Yubikey PIV PIN caching (and prefer CV25519 to NIST curves).
i have very little confidence recommending anything other than bitwarden/vaultwarden or keepassxc